DKIM explained - 2048-bit keys, rotation, verification
How DKIM works, why InboxLee uses 2048-bit keys, and how rotation should be done.
On this page · 4
- How it works
- Why 2048-bit
- Rotation
- Verifying
DKIM (DomainKeys Identified Mail) is a cryptographic signature attached to every outbound message. It proves the email was authorized by the domain owner and was not modified in transit. Without DKIM, Gmail treats your cold outreach as suspect immediately.
How it works
Your sending server holds a private key. The mail server adds a header containing a hash of the message body and headers, signed with that private key. Receivers fetch the corresponding public key from a TXT record at <selector>._domainkey.<yourdomain> and verify the signature.
The selector is a label that lets you publish multiple keys (for rotation). InboxLee uses the selector "google" by default for Workspace-provisioned mailboxes, matching the Google Workspace convention.
Why 2048-bit
Google has flagged 1024-bit DKIM keys as insecure since 2023. Microsoft and Yahoo follow the same posture. 2048-bit RSA is the modern baseline. Some older DNS providers limit individual TXT records to 255 chars, which forces 2048-bit keys to be split across multiple quoted strings - most modern DNS providers handle this correctly.
InboxLee provisions every domain with 2048-bit keys, split if necessary, on InboxLee-managed DNS by default.
Rotation
A DKIM key should be rotated roughly every 12 months, using the dual-selector method so no message ever fails verification mid-flight:
Done in that order there is no downtime and no failed signature, because both keys resolve during the overlap. Rotation is not currently automated on InboxLee-managed domains - talk to support when a key is due and we will run the sequence above with you.
Verifying
dig +short TXT google._domainkey.yourdomain.com
You should see a long base64-encoded public key starting with "v=DKIM1; k=rsa; p=...". The InboxLee dashboard shows DKIM status on every domain page in real time.